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Data Ethics Policy 


Lundbeck is a global company engaged in the research, development, 
manufacturing, and commercialization of pharmaceuticals across the world. We 
are 5,600 people in +50 countries. 


We process data for well-defined purposes that ultimately aim to improve the lives 
of patients. We comply with all applicable data privacy laws and regulations and 
have implemented rigorous controls to ensure adherence with our Data Privacy 
Policy and Procedures. 


This Data Ethics Policy adds to these controls and is particularly relevant in the 
design and application of digital technologies. It also applies to the processing of 
non-personal data e.g. production and market data. 


The policy is intended to guide ethical and responsible decisions on our use of data 
for maximal benefit and minimal harm for individuals and society. 


Data Ethics principles 
With this policy we incorporate our commitment to the principles of ethical data use from the International 
Federation of Pharmaceutical Manufactures & Associations (IFPMA): 


1. Autonomy: Respect individuals’ privacy, protect their rights and honor confidentiality. 


Data should be collected and used in ways that are consistent with the intentions and 
understanding of the individual. Best efforts should be made to make individuals aware of how their 
data will be used and, where appropriate and possible, offer them choices about who has access to 
their data and how it may be used. 


2. Transparency: Individuals should be able to understand how their personal data are used. 


Individuals should be informed in an appropriate and understandable manner regarding the type 
and extent of data collected about them; how it will be used; how technologies are used to aid 
decisions that impact them; how their rights are protected; and what actions they may take to 
exercise their rights. Legally permissible limitations on such rights should be clearly explained. Data 
governance standards and practices should be made available for public review, when appropriate. 


3. Data quality: The best quality data available should be used to make decisions. 


Data use should include processes to identify, prevent, and off-set poor quality, incomplete or 
inaccurate data. When data quality, completeness or accuracy presents risks of bias or harm to the 
individual, processes for mitigating these risks should be pursued and documented. 
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4. Fairness and non-discrimination: Data acquisition should be inclusive, equitable, and seek to 
support the industry’s mission of responding to the needs of all patients. 


Engaging a diverse set of stakeholders in decision-making around data use and development of 
technologies to leverage data can build trust and support efforts to eliminate harmful biases. 
Technologies leveraging data should also include data-driven processes for quantifying the 
potential for bias in the populations in which they are being deployed. 


5. Ethics by design: Controls to prevent harm and risks to individuals should be built into the design 
of data architecture and data processing. 


This includes having processes in place to identify, assess, and mitigate risks of intentional and 
unintentional discrimination and bias, breaches in privacy and security, physical harm and other 
adverse impacts on individuals. Protecting privacy also includes applying strong cybersecurity 
standards and appropriately preparing the data for use (e.g. through use of anonymization and 
pseudonymization techniques where relevant and appropriate) and restricting re-identification of 
pseudonymized data without permission. 


6. Responsible data sharing: Data sharing should be based on processes that actively and 
consistently consider, prioritize and protect individual rights. 
Data should always be obtained by legitimate means and there should be designated individuals 
accountable for safeguarding the data and ensuring confidentiality. Third parties working with 
Lundbeck should be informed about and expected to adhere to these principles. In addition, data 
interoperability initiatives should prioritize, include and support ethical and responsible data sharing 
practices. 


7. Responsibility and Accountability: These principles are operationalized through effective 
governance, clear standards, training, monitoring activities and disciplinary sanctions. 


Senior management is made aware and should ensure the application of the ethical principles in 
decisions regarding the use of data in strategic activities. 


Ethical aspects of new digital data processing technologies are assessed in consultation with 
Lundbeck’s specialists within data privacy and ethics. This includes considering stakeholder 
expectations and current understanding of the risks and benefits to individuals of the data use. 


Lundbeck will routinely monitor compliance and assess the effectiveness of the current policy as 
part of our Code of Conduct Compliance Program. 


Relevant documents and information 
For further information, please follow the below links: 


e Lundbeck’s Code of Conduct 
e Responsible business conduct, including Lundbeck’s Data Privacy Policy 


